BUG: TASK stack guard page was hit at ffffc90000c0fff8 (stack is ffffc90000c10000..ffffc90000c18000) stack guard page: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 513 Comm: syz-executor.0 Not tainted 5.19.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 RIP: 0010:zone_watermark_fast+0x8/0x210 mm/page_alloc.c:3961 Code: 44 24 10 41 bf 41 00 00 00 e9 c0 f6 ff ff 89 c6 48 c7 c7 00 b4 e3 85 e8 16 3c c5 00 e9 4d fd ff ff 90 55 48 89 e5 41 57 41 56 <41> 55 41 54 53 48 83 ec 18 44 89 4d cc 45 89 c7 89 4d d4 48 89 55 RSP: 0018:ffffc90000c10000 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000901 RCX: 0000000000000001 RDX: 0000000000003f26 RSI: 0000000000000002 RDI: ffffffff863bb480 RBP: ffffc90000c10010 R08: 0000000000000901 R09: 0000000000102800 R10: 0000000000000000 R11: dffffc0000000001 R12: ffffc90000c10330 R13: 0000000000002800 R14: 0000000000102800 R15: 0000000000003f26 FS: 00007f298f156700(0000) GS:ffff8881f7200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc90000c0fff8 CR3: 000000010d404000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: get_page_from_freelist+0x3e5/0x3190 mm/page_alloc.c:4152 __alloc_pages+0x3c2/0x7d0 mm/page_alloc.c:5426 __alloc_pages_node include/linux/gfp.h:587 [inline] alloc_pages_node include/linux/gfp.h:610 [inline] alloc_pages include/linux/gfp.h:621 [inline] __stack_depot_save+0x38d/0x470 lib/stackdepot.c:418 stack_depot_save+0xe/0x10 lib/stackdepot.c:475 save_stack+0xeb/0x1b0 mm/page_owner.c:128 __set_page_owner+0x24/0x40 mm/page_owner.c:192 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1e2/0x1f0 mm/page_alloc.c:2449 prep_new_page mm/page_alloc.c:2456 [inline] get_page_from_freelist+0x30b5/0x3190 mm/page_alloc.c:4198 __alloc_pages+0x3c2/0x7d0 mm/page_alloc.c:5426 __alloc_pages_node include/linux/gfp.h:587 [inline] alloc_pages_node include/linux/gfp.h:610 [inline] alloc_pages include/linux/gfp.h:621 [inline] __stack_depot_save+0x38d/0x470 lib/stackdepot.c:418 kasan_save_stack mm/kasan/common.c:39 [inline] kasan_set_track+0x5d/0x70 mm/kasan/common.c:45 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370 ____kasan_slab_free+0x133/0x170 mm/kasan/common.c:366 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:374 kasan_slab_free include/linux/kasan.h:200 [inline] slab_free_hook mm/slub.c:1754 [inline] slab_free_freelist_hook+0xbd/0x190 mm/slub.c:1780 slab_free mm/slub.c:3536 [inline] kmem_cache_free+0x110/0x2d0 mm/slub.c:3553 kfree_skbmem+0xb6/0x110 __kfree_skb net/core/skbuff.c:767 [inline] kfree_skb_reason net/core/skbuff.c:788 [inline] kfree_skb_list_reason+0xd2/0x1c0 net/core/skbuff.c:798 kfree_skb_list include/linux/skbuff.h:1217 [inline] __dev_queue_xmit+0xe85/0x2c40 net/core/dev.c:4279 dev_queue_xmit include/linux/netdevice.h:2994 [inline] neigh_connected_output+0x42a/0x4b0 net/core/neighbour.c:1557 neigh_output include/net/neighbour.h:550 [inline] ip_finish_output2+0x99e/0xee0 net/ipv4/ip_output.c:228 __ip_finish_output+0x148/0x2f0 ip_finish_output+0x27/0x200 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip_mc_output+0x326/0x960 net/ipv4/ip_output.c:415 dst_output include/net/dst.h:451 [inline] ip_local_out+0x71/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x4a0/0x800 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1929/0x2690 net/ipv4/ip_tunnel.c:812 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x683/0x9e0 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4805 [inline] netdev_start_xmit include/linux/netdevice.h:4819 [inline] xmit_one net/core/dev.c:3590 [inline] dev_hard_start_xmit+0x1d2/0x4c0 net/core/dev.c:3606 __dev_queue_xmit+0x1389/0x2c40 net/core/dev.c:4255 dev_queue_xmit include/linux/netdevice.h:2994 [inline] neigh_connected_output+0x42a/0x4b0 net/core/neighbour.c:1557 neigh_output include/net/neighbour.h:550 [inline] ip_finish_output2+0x99e/0xee0 net/ipv4/ip_output.c:228 __ip_finish_output+0x148/0x2f0 ip_finish_output+0x27/0x200 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip_mc_output+0x326/0x960 net/ipv4/ip_output.c:415 dst_output include/net/dst.h:451 [inline] ip_local_out+0x71/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x4a0/0x800 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1929/0x2690 net/ipv4/ip_tunnel.c:812 sit_tunnel_xmit__ net/ipv6/sit.c:1057 [inline] sit_tunnel_xmit+0x9c8/0x2170 net/ipv6/sit.c:1073 __netdev_start_xmit include/linux/netdevice.h:4805 [inline] netdev_start_xmit include/linux/netdevice.h:4819 [inline] xmit_one net/core/dev.c:3590 [inline] dev_hard_start_xmit+0x1d2/0x4c0 net/core/dev.c:3606 __dev_queue_xmit+0x1389/0x2c40 net/core/dev.c:4255 dev_queue_xmit include/linux/netdevice.h:2994 [inline] neigh_connected_output+0x42a/0x4b0 net/core/neighbour.c:1557 neigh_output include/net/neighbour.h:550 [inline] ip_finish_output2+0x99e/0xee0 net/ipv4/ip_output.c:228 __ip_finish_output+0x148/0x2f0 ip_finish_output+0x27/0x200 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip_mc_output+0x326/0x960 net/ipv4/ip_output.c:415 dst_output include/net/dst.h:451 [inline] ip_local_out+0x71/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x4a0/0x800 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1929/0x2690 net/ipv4/ip_tunnel.c:812 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x683/0x9e0 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4805 [inline] netdev_start_xmit include/linux/netdevice.h:4819 [inline] xmit_one net/core/dev.c:3590 [inline] dev_hard_start_xmit+0x1d2/0x4c0 net/core/dev.c:3606 __dev_queue_xmit+0x1389/0x2c40 net/core/dev.c:4255 dev_queue_xmit include/linux/netdevice.h:2994 [inline] neigh_connected_output+0x42a/0x4b0 net/core/neighbour.c:1557 neigh_output include/net/neighbour.h:550 [inline] ip_finish_output2+0x99e/0xee0 net/ipv4/ip_output.c:228 __ip_finish_output+0x148/0x2f0 ip_finish_output+0x27/0x200 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip_mc_output+0x326/0x960 net/ipv4/ip_output.c:415 dst_output include/net/dst.h:451 [inline] ip_local_out+0x71/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x4a0/0x800 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1929/0x2690 net/ipv4/ip_tunnel.c:812 sit_tunnel_xmit__ net/ipv6/sit.c:1057 [inline] sit_tunnel_xmit+0x9c8/0x2170 net/ipv6/sit.c:1073 __netdev_start_xmit include/linux/netdevice.h:4805 [inline] netdev_start_xmit include/linux/netdevice.h:4819 [inline] xmit_one net/core/dev.c:3590 [inline] dev_hard_start_xmit+0x1d2/0x4c0 net/core/dev.c:3606 __dev_queue_xmit+0x1389/0x2c40 net/core/dev.c:4255 dev_queue_xmit include/linux/netdevice.h:2994 [inline] neigh_connected_output+0x42a/0x4b0 net/core/neighbour.c:1557 neigh_output include/net/neighbour.h:550 [inline] ip_finish_output2+0x99e/0xee0 net/ipv4/ip_output.c:228 __ip_finish_output+0x148/0x2f0 ip_finish_output+0x27/0x200 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip_mc_output+0x326/0x960 net/ipv4/ip_output.c:415 dst_output include/net/dst.h:451 [inline] ip_local_out+0x71/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x4a0/0x800 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1929/0x2690 net/ipv4/ip_tunnel.c:812 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x683/0x9e0 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4805 [inline] netdev_start_xmit include/linux/netdevice.h:4819 [inline] xmit_one net/core/dev.c:3590 [inline] dev_hard_start_xmit+0x1d2/0x4c0 net/core/dev.c:3606 __dev_queue_xmit+0x1389/0x2c40 net/core/dev.c:4255 dev_queue_xmit include/linux/netdevice.h:2994 [inline] neigh_connected_output+0x42a/0x4b0 net/core/neighbour.c:1557 neigh_output include/net/neighbour.h:550 [inline] ip_finish_output2+0x99e/0xee0 net/ipv4/ip_output.c:228 __ip_finish_output+0x148/0x2f0 ip_finish_output+0x27/0x200 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip_mc_output+0x326/0x960 net/ipv4/ip_output.c:415 dst_output include/net/dst.h:451 [inline] ip_local_out+0x71/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x4a0/0x800 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1929/0x2690 net/ipv4/ip_tunnel.c:812 sit_tunnel_xmit__ net/ipv6/sit.c:1057 [inline] sit_tunnel_xmit+0x9c8/0x2170 net/ipv6/sit.c:1073 __netdev_start_xmit include/linux/netdevice.h:4805 [inline] netdev_start_xmit include/linux/netdevice.h:4819 [inline] xmit_one net/core/dev.c:3590 [inline] dev_hard_start_xmit+0x1d2/0x4c0 net/core/dev.c:3606 __dev_queue_xmit+0x1389/0x2c40 net/core/dev.c:4255 dev_queue_xmit include/linux/netdevice.h:2994 [inline] neigh_connected_output+0x42a/0x4b0 net/core/neighbour.c:1557 neigh_output include/net/neighbour.h:550 [inline] ip_finish_output2+0x99e/0xee0 net/ipv4/ip_output.c:228 __ip_finish_output+0x148/0x2f0 ip_finish_output+0x27/0x200 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip_mc_output+0x326/0x960 net/ipv4/ip_output.c:415 dst_output include/net/dst.h:451 [inline] ip_local_out+0x71/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x4a0/0x800 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1929/0x2690 net/ipv4/ip_tunnel.c:812 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x683/0x9e0 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4805 [inline] netdev_start_xmit include/linux/netdevice.h:4819 [inline] xmit_one net/core/dev.c:3590 [inline] dev_hard_start_xmit+0x1d2/0x4c0 net/core/dev.c:3606 __dev_queue_xmit+0x1389/0x2c40 net/core/dev.c:4255 dev_queue_xmit include/linux/netdevice.h:2994 [inline] neigh_connected_output+0x42a/0x4b0 net/core/neighbour.c:1557 neigh_output include/net/neighbour.h:550 [inline] ip_finish_output2+0x99e/0xee0 net/ipv4/ip_output.c:228 __ip_finish_output+0x148/0x2f0 ip_finish_output+0x27/0x200 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip_mc_output+0x326/0x960 net/ipv4/ip_output.c:415 dst_output include/net/dst.h:451 [inline] ip_local_out+0x71/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x4a0/0x800 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1929/0x2690 net/ipv4/ip_tunnel.c:812 sit_tunnel_xmit__ net/ipv6/sit.c:1057 [inline] sit_tunnel_xmit+0x9c8/0x2170 net/ipv6/sit.c:1073 __netdev_start_xmit include/linux/netdevice.h:4805 [inline] netdev_start_xmit include/linux/netdevice.h:4819 [inline] xmit_one net/core/dev.c:3590 [inline] dev_hard_start_xmit+0x1d2/0x4c0 net/core/dev.c:3606 __dev_queue_xmit+0x1389/0x2c40 net/core/dev.c:4255 dev_queue_xmit include/linux/netdevice.h:2994 [inline] neigh_connected_output+0x42a/0x4b0 net/core/neighbour.c:1557 neigh_output include/net/neighbour.h:550 [inline] ip_finish_output2+0x99e/0xee0 net/ipv4/ip_output.c:228 __ip_finish_output+0x148/0x2f0 ip_finish_output+0x27/0x200 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip_mc_output+0x326/0x960 net/ipv4/ip_output.c:415 dst_output include/net/dst.h:451 [inline] ip_local_out+0x71/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x4a0/0x800 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1929/0x2690 net/ipv4/ip_tunnel.c:812 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x683/0x9e0 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4805 [inline] netdev_start_xmit include/linux/netdevice.h:4819 [inline] xmit_one net/core/dev.c:3590 [inline] dev_hard_start_xmit+0x1d2/0x4c0 net/core/dev.c:3606 __dev_queue_xmit+0x1389/0x2c40 net/core/dev.c:4255 dev_queue_xmit include/linux/netdevice.h:2994 [inline] neigh_connected_output+0x42a/0x4b0 net/core/neighbour.c:1557 neigh_output include/net/neighbour.h:550 [inline] ip_finish_output2+0x99e/0xee0 net/ipv4/ip_output.c:228 __ip_finish_output+0x148/0x2f0 ip_finish_output+0x27/0x200 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip_mc_output+0x326/0x960 net/ipv4/ip_output.c:415 dst_output include/net/dst.h:451 [inline] ip_local_out net/ipv4/ip_output.c:126 [inline] ip_send_skb net/ipv4/ip_output.c:1589 [inline] ip_push_pending_frames+0xea/0x140 net/ipv4/ip_output.c:1609 raw_sendmsg+0x102a/0x1f60 net/ipv4/raw.c:645 inet_sendmsg+0x8c/0xa0 net/ipv4/af_inet.c:819 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] ____sys_sendmsg+0x495/0x7c0 net/socket.c:2487 ___sys_sendmsg+0x215/0x2a0 net/socket.c:2541 __sys_sendmmsg+0x220/0x3a0 net/socket.c:2627 __do_sys_sendmmsg net/socket.c:2656 [inline] __se_sys_sendmmsg net/socket.c:2653 [inline] __x64_sys_sendmmsg+0x9b/0xb0 net/socket.c:2653 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f298e48c199 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f298f156168 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 00007f298e5abf80 RCX: 00007f298e48c199 RDX: 0000000000000300 RSI: 0000000020003380 RDI: 0000000000000003 RBP: 00007f298e4e7ca1 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd9d7e577f R14: 00007f298f156300 R15: 0000000000022000 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:zone_watermark_fast+0x8/0x210 mm/page_alloc.c:3961 Code: 44 24 10 41 bf 41 00 00 00 e9 c0 f6 ff ff 89 c6 48 c7 c7 00 b4 e3 85 e8 16 3c c5 00 e9 4d fd ff ff 90 55 48 89 e5 41 57 41 56 <41> 55 41 54 53 48 83 ec 18 44 89 4d cc 45 89 c7 89 4d d4 48 89 55 RSP: 0018:ffffc90000c10000 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000901 RCX: 0000000000000001 RDX: 0000000000003f26 RSI: 0000000000000002 RDI: ffffffff863bb480 RBP: ffffc90000c10010 R08: 0000000000000901 R09: 0000000000102800 R10: 0000000000000000 R11: dffffc0000000001 R12: ffffc90000c10330 R13: 0000000000002800 R14: 0000000000102800 R15: 0000000000003f26 FS: 00007f298f156700(0000) GS:ffff8881f7200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc90000c0fff8 CR3: 000000010d404000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 44 24 10 rex.R and $0x10,%al 3: 41 bf 41 00 00 00 mov $0x41,%r15d 9: e9 c0 f6 ff ff jmpq 0xfffff6ce e: 89 c6 mov %eax,%esi 10: 48 c7 c7 00 b4 e3 85 mov $0xffffffff85e3b400,%rdi 17: e8 16 3c c5 00 callq 0xc53c32 1c: e9 4d fd ff ff jmpq 0xfffffd6e 21: 90 nop 22: 55 push %rbp 23: 48 89 e5 mov %rsp,%rbp 26: 41 57 push %r15 28: 41 56 push %r14 * 2a: 41 55 push %r13 <-- trapping instruction 2c: 41 54 push %r12 2e: 53 push %rbx 2f: 48 83 ec 18 sub $0x18,%rsp 33: 44 89 4d cc mov %r9d,-0x34(%rbp) 37: 45 89 c7 mov %r8d,%r15d 3a: 89 4d d4 mov %ecx,-0x2c(%rbp) 3d: 48 rex.W 3e: 89 .byte 0x89 3f: 55 push %rbp